Help with web usage

[Board4aLiving]

I have one server running SBS2003. When I recieved the last usage report, I noticed that 2 PC's total active hours for web usage is over 250 hours. All other users are around 20 to 50 hours. How would I go about troubleshooting this?

I already have checked the client PC's and looked for processes running that shouldn't be and disabled any programs or scripts that run during startup.

Any suggestions?

Board4aLiving

 

[Albion]

I've had this same problem when looking at my web usage. It turned out that 2 of my users were listening to Shoutcast streams (Streaming audio) on their machines all day long.

There is so much stuff that talks to the internet all the time. Have you checked the machines for spyware, trojans, backdoors, sniffers, stupid 'weather bug' or 'stock ticker' programs? These all talk constantly to the internet and most of the malware among them won't have a trace in the process list, logs, or startup. I am assuming that you are running virus/firewall at the client and server level.

I think I would start by first logging your firewall for those two machines and watching who they're talking to. This can give you insite into what they are doing. Second I would install an admin managed firewall on the machines to see who raises their head when they can't connect to their <whatever it is they're trying to connecting to>. It's amazing how a phone call asking, "Why can't I do such and such on the internet anymore?", can easily solve your problem.

good luck

-Al

 

[mrdenny]

It could also be something like AIM, ICQ, MSN Messanger, etc. They all keep an open connection to the net.

Denny

--Anything is possible. All it takes is a little research. (Me)